CVE-2026-10031
SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation
CVSS Score
4.2
EPSS Score
0.0%
EPSS Percentile
0th
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions.
| CWE | CWE-863 |
| Vendor | drakkan |
| Product | sftpgo |
| Published | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for drakkan sftpgo
Be the first to know when new medium vulnerabilities affecting drakkan sftpgo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
drakkan / SFTPGo
0 < 2.7.4
References
github.com: https://github.com/drakkan/sftpgo github.com: https://github.com/drakkan/sftpgo/security/advisories/GHSA-fj9v-mxr3-w75w github.com: https://github.com/drakkan/sftpgo/releases/tag/v2.7.4 vulncheck.com: https://www.vulncheck.com/advisories/sftpgo-permission-bypass-via-symbolic-link-creation
Credits
🔍 Nullx3D (Batuhan SANCAK)